                 (send-error-message message not-authorized-msg connection)))
             :expired
             (do
-              ;; TODO(ale): log access (PCP-385)
+              (log-access :warn (assoc message-data :accessoutcome "EXPIRED"))
               (if is-association-request
                 ;; send back the ttl-expired immediately, without queueing
                 (let [response (make-ttl_expired-message message)

        (try+
          (case (validate-message broker capsule connection is-association-request)
            :to-be-ignored-during-association
            ;; TODO(ale): log access (PCP-385); doing nothing for now
            (do)
            :not-authenticated
            (let [not-authenticated-msg (i18n/trs "Message not authenticated")]
              (if is-association-request
                ;; send an unsuccessful associate_response and close the WebSocket
                (process-associate-request! broker capsule connection not-authenticated-msg)
                (send-error-message message not-authenticated-msg connection)))
            :not-authorized
            (let [not-authorized-msg (i18n/trs "Message not authorized")]
              (if is-association-request
                ;; send an unsuccessful associate_response and close the WebSocket
                (process-associate-request! broker capsule connection not-authorized-msg)

              nil)
            :to-be-processed
            (do
              (log-access :info (assoc message-data :accessoutcome "AUTHORIZATION_SUCCESS"))
              (let [uri (broker-uri broker)
                    capsule (capsule/add-hop capsule uri "accepted")]
                (if (= (:targets message) ["pcp:///server"])
